Skip to content

fix(security): Phase 0 critical hardening (guildModuleAccess enforcement) #664

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
LucasSantana-Dev merged 3 commits into from
Apr 16, 2026
Merged

fix(security): Phase 0 critical hardening (guildModuleAccess enforcement) #664

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
db72570
fix(security): require guildModuleAccess on roles and moderation routes
LucasSantana-Dev Apr 16, 2026
4d188e6
test(security): update role and moderation tests to mock guildAccessS…
LucasSantana-Dev Apr 16, 2026
7e133b3
Merge branch 'main' into fix/phase-0-critical-security
LucasSantana-Dev Apr 16, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions packages/backend/src/routes/moderation.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import type { Express, Response } from 'express'
import { requireAuth, type AuthenticatedRequest } from '../middleware/auth'
import { requireGuildModuleAccess } from '../middleware/guildAccess'
import {
validateBody,
validateParams,
Expand Down Expand Up @@ -27,6 +28,7 @@ export function setupModerationRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/moderation/cases',
requireAuth,
requireGuildModuleAccess('moderation', 'view'),
validateParams(s.guildIdParam),
validateQuery(s.casesQuery),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
Expand All @@ -43,6 +45,7 @@ export function setupModerationRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/moderation/cases/:caseNumber',
requireAuth,
requireGuildModuleAccess('moderation', 'view'),
validateParams(s.caseNumberParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
const modCase = await moderationService.getCase(
Expand All @@ -59,6 +62,7 @@ export function setupModerationRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/moderation/users/:userId/cases',
requireAuth,
requireGuildModuleAccess('moderation', 'view'),
validateParams(s.userCasesParam),
validateQuery(s.userCasesQuery),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
Expand All @@ -76,6 +80,7 @@ export function setupModerationRoutes(app: Express): void {
app.patch(
'/api/guilds/:guildId/moderation/cases/:caseNumber/reason',
requireAuth,
requireGuildModuleAccess('moderation', 'manage'),
writeLimiter,
validateParams(s.caseNumberParam),
validateBody(s.updateReasonBody),
Expand Down Expand Up @@ -107,6 +112,7 @@ export function setupModerationRoutes(app: Express): void {
app.post(
'/api/guilds/:guildId/moderation/cases/:caseId/deactivate',
requireAuth,
requireGuildModuleAccess('moderation', 'manage'),
writeLimiter,
validateParams(s.caseIdParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
Expand All @@ -129,6 +135,7 @@ export function setupModerationRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/moderation/settings',
requireAuth,
requireGuildModuleAccess('moderation', 'view'),
validateParams(s.guildIdParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
const settings = await moderationService.getSettings(
Expand All @@ -141,6 +148,7 @@ export function setupModerationRoutes(app: Express): void {
app.patch(
'/api/guilds/:guildId/moderation/settings',
requireAuth,
requireGuildModuleAccess('moderation', 'manage'),
writeLimiter,
validateParams(s.guildIdParam),
validateBody(s.updateSettingsBody),
Expand All @@ -164,6 +172,7 @@ export function setupModerationRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/moderation/stats',
requireAuth,
requireGuildModuleAccess('moderation', 'view'),
validateParams(s.guildIdParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
const stats = await moderationService.getStats(
Expand Down
3 changes: 3 additions & 0 deletions packages/backend/src/routes/roles.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
import type { Express, Response } from 'express'
import { requireAuth, type AuthenticatedRequest } from '../middleware/auth'
import { requireGuildModuleAccess } from '../middleware/guildAccess'
import { validateParams } from '../middleware/validate'
import { asyncHandler } from '../middleware/asyncHandler'
import { managementSchemas as s } from '../schemas/management'
Expand All @@ -16,6 +17,7 @@ export function setupRolesRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/reaction-roles',
requireAuth,
requireGuildModuleAccess('overview', 'view'),
validateParams(s.guildIdParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
const guildId = p(req.params.guildId)
Expand All @@ -28,6 +30,7 @@ export function setupRolesRoutes(app: Express): void {
app.get(
'/api/guilds/:guildId/roles/exclusive',
requireAuth,
requireGuildModuleAccess('overview', 'view'),
validateParams(s.guildIdParam),
asyncHandler(async (req: AuthenticatedRequest, res: Response) => {
const guildId = p(req.params.guildId)
Expand Down
129 changes: 45 additions & 84 deletions packages/backend/tests/integration/routes/moderation.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,6 +5,7 @@ import express from 'express'
import { setupModerationRoutes } from '../../../src/routes/moderation'
import { setupSessionMiddleware } from '../../../src/middleware/session'
import { sessionService } from '../../../src/services/SessionService'
import { guildAccessService } from '../../../src/services/GuildAccessService'
import { MOCK_SESSION_DATA } from '../../fixtures/mock-data'

jest.mock('../../../src/services/SessionService', () => ({
Expand All @@ -13,6 +14,13 @@ jest.mock('../../../src/services/SessionService', () => ({
},
}))

jest.mock('../../../src/services/GuildAccessService', () => ({
guildAccessService: {
resolveGuildContext: jest.fn(),
hasAccess: jest.fn(),
},
}))

jest.mock('@lucky/shared/services', () => ({
redisClient: {
isHealthy: jest.fn(() => true),
Expand Down Expand Up @@ -51,6 +59,22 @@ jest.mock('@lucky/shared/services', () => ({
import { moderationService, serverLogService } from '@lucky/shared/services'

describe('Moderation Routes Integration', () => {
const GUILD_ID = '111111111111111111'

function setupAuth() {
const sessionMock = sessionService as jest.Mocked<typeof sessionService>
sessionMock.getSession.mockResolvedValue(MOCK_SESSION_DATA)

const accessMock = guildAccessService as jest.Mocked<typeof guildAccessService>
accessMock.resolveGuildContext.mockResolvedValue({
guildId: GUILD_ID,
userId: MOCK_SESSION_DATA.userId,
roles: [],
permissions: new Set(),
} as any)
accessMock.hasAccess.mockReturnValue(true)
}

let app: express.Express

beforeEach(() => {
Expand All @@ -64,10 +88,7 @@ describe('Moderation Routes Integration', () => {

describe('GET /api/guilds/:guildId/moderation/cases', () => {
test('should return recent cases with default limit', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockCases = [
{
Expand Down Expand Up @@ -99,10 +120,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return recent cases with custom limit', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand Down Expand Up @@ -134,10 +152,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -159,10 +174,7 @@ describe('Moderation Routes Integration', () => {

describe('GET /api/guilds/:guildId/moderation/cases/:caseNumber', () => {
test('should return specific case', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockCase = {
id: 'case1',
Expand Down Expand Up @@ -193,10 +205,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 404 when case not found', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand Down Expand Up @@ -225,10 +234,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -248,10 +254,7 @@ describe('Moderation Routes Integration', () => {

describe('GET /api/guilds/:guildId/moderation/users/:userId/cases', () => {
test('should return user cases with activeOnly=false', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockCases = [
{
Expand Down Expand Up @@ -287,10 +290,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return user cases with activeOnly=true', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand Down Expand Up @@ -327,10 +327,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -354,10 +351,7 @@ describe('Moderation Routes Integration', () => {

describe('PATCH /api/guilds/:guildId/moderation/cases/:caseNumber/reason', () => {
test('should update case reason', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockCase = {
id: 'case1',
Expand Down Expand Up @@ -406,10 +400,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 400 when reason is missing', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const response = await request(app)
.patch(
Expand All @@ -427,10 +418,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 404 when case not found', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand Down Expand Up @@ -465,10 +453,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -493,10 +478,7 @@ describe('Moderation Routes Integration', () => {

describe('POST /api/guilds/:guildId/moderation/cases/:caseId/deactivate', () => {
test('should deactivate case', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockUpdatedCase = {
id: 'case1',
Expand Down Expand Up @@ -558,10 +540,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -585,10 +564,7 @@ describe('Moderation Routes Integration', () => {

describe('GET /api/guilds/:guildId/moderation/settings', () => {
test('should return moderation settings', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockSettings = {
guildId: '111111111111111111',
Expand Down Expand Up @@ -627,10 +603,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -652,10 +625,7 @@ describe('Moderation Routes Integration', () => {

describe('PATCH /api/guilds/:guildId/moderation/settings', () => {
test('should update moderation settings', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockSettings = {
guildId: '111111111111111111',
Expand Down Expand Up @@ -719,10 +689,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand All @@ -745,10 +712,7 @@ describe('Moderation Routes Integration', () => {

describe('GET /api/guilds/:guildId/moderation/stats', () => {
test('should return moderation stats', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockStats = {
totalCases: 42,
Expand Down Expand Up @@ -790,10 +754,7 @@ describe('Moderation Routes Integration', () => {
})

test('should return 500 on service error', async () => {
const mockSessionService = sessionService as jest.Mocked<
typeof sessionService
>
mockSessionService.getSession.mockResolvedValue(MOCK_SESSION_DATA)
setupAuth()

const mockModerationService = moderationService as jest.Mocked<
typeof moderationService
Expand Down
Loading
Loading